@rudderhq/cli 0.7.6 → 0.7.7

package/dist/index.js

@@ -3460,17 +3460,20 @@ var init_resource = __esm({
       resourceId: z19.string().uuid(),
       role: projectResourceAttachmentRoleSchema.optional(),
       note: z19.string().optional().nullable(),
-      sortOrder: z19.number().int().nonnegative().optional()
+      sortOrder: z19.number().int().nonnegative().optional(),
+      isPrimary: z19.boolean().optional()
     }).strict();
     updateProjectResourceAttachmentSchema = z19.object({
       role: projectResourceAttachmentRoleSchema.optional(),
       note: z19.string().optional().nullable(),
-      sortOrder: z19.number().int().nonnegative().optional()
+      sortOrder: z19.number().int().nonnegative().optional(),
+      isPrimary: z19.boolean().optional()
     }).strict();
     createProjectInlineResourceSchema = createOrganizationResourceBaseSchema.extend({
       role: projectResourceAttachmentRoleSchema.optional(),
       note: z19.string().optional().nullable(),
-      sortOrder: z19.number().int().nonnegative().optional()
+      sortOrder: z19.number().int().nonnegative().optional(),
+      isPrimary: z19.boolean().optional()
     }).strict().superRefine(validateLibraryResourceContract);
   }
 });
@@ -5413,9 +5416,13 @@ var init_postgres_payload = __esm({
 
 // src/runtime/install.ts
 import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
+import { createReadStream, createWriteStream } from "node:fs";
 import { copyFile, mkdir as mkdir2, mkdtemp, readFile, readdir, realpath, rename, rm, stat as stat2, symlink, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import path7 from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
 function sanitizeRuntimeCacheSegment(value) {
   return encodeURIComponent(value.trim() || "latest").replaceAll("%", "_");
@@ -6137,8 +6144,29 @@ function runtimePostgresArchiveUrl(platform = process.platform, arch = process.a
   return null;
 }
 async function downloadRuntimePostgresArchive(url, targetPath) {
+  const expectedSha256 = process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256_ENV]?.trim().toLowerCase() || null;
+  if (expectedSha256 && !/^[a-f0-9]{64}$/.test(expectedSha256)) {
+    throw new Error(`${RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256_ENV} must be a 64-character SHA-256 digest`);
+  }
+  const configuredMaxBytes = Number.parseInt(process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV] ?? "", 10);
+  const maxBytes = Number.isSafeInteger(configuredMaxBytes) && configuredMaxBytes > 0 ? configuredMaxBytes : DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES;
+  async function verifyFile(filePath) {
+    if (!expectedSha256) return;
+    const hash = createHash2("sha256");
+    await new Promise((resolve, reject) => {
+      const stream = createReadStream(filePath);
+      stream.on("data", (chunk) => hash.update(chunk));
+      stream.on("error", reject);
+      stream.on("end", resolve);
+    });
+    const actual = hash.digest("hex");
+    if (actual !== expectedSha256) throw new Error(`PostgreSQL runtime archive SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
+  }
   if (url.startsWith("file://")) {
     await copyFile(fileURLToPath3(url), targetPath);
+    const archiveStat = await stat2(targetPath);
+    if (archiveStat.size > maxBytes) throw new Error(`PostgreSQL runtime archive exceeds ${maxBytes} bytes`);
+    await verifyFile(targetPath);
     return;
   }
   const parsedTimeout = Number.parseInt(
@@ -6152,7 +6180,33 @@ async function downloadRuntimePostgresArchive(url, targetPath) {
     if (!response.ok) {
       throw new Error(`failed to download ${url}: ${response.status} ${response.statusText}`);
     }
-    await writeFile(targetPath, Buffer.from(await response.arrayBuffer()));
+    const contentLength = Number.parseInt(response.headers.get("content-length") ?? "", 10);
+    if (Number.isSafeInteger(contentLength) && contentLength > maxBytes) {
+      throw new Error(`PostgreSQL runtime archive exceeds ${maxBytes} bytes`);
+    }
+    if (!response.body) throw new Error("PostgreSQL runtime archive response has no body");
+    const hash = createHash2("sha256");
+    let bytes = 0;
+    const monitor = new Transform({
+      transform(chunk, _encoding, callback) {
+        bytes += chunk.byteLength;
+        if (bytes > maxBytes) {
+          callback(new Error(`PostgreSQL runtime archive exceeds ${maxBytes} bytes`));
+          return;
+        }
+        hash.update(chunk);
+        callback(null, chunk);
+      }
+    });
+    await pipeline(
+      Readable.fromWeb(response.body),
+      monitor,
+      createWriteStream(targetPath, { flags: "wx" })
+    );
+    if (expectedSha256) {
+      const actual = hash.digest("hex");
+      if (actual !== expectedSha256) throw new Error(`PostgreSQL runtime archive SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
+    }
   } finally {
     if (timeout) clearTimeout(timeout);
   }
@@ -6672,7 +6726,7 @@ function parseRuntimeVersion(version) {
     canaryNumber: canaryMatch ? Number(canaryMatch[1]) : null
   };
 }
-var RUNTIME_NPM_PACKAGE_NAME, NPM_PUBLIC_REGISTRY_URL, RUNTIME_METADATA_FILE, RUNTIME_POSTGRES_PAYLOAD_DIR, DEFAULT_RUNTIME_CACHE_MAX_ENTRIES, DEFAULT_RUNTIME_CACHE_MAX_AGE_MS, DEFAULT_RUNTIME_CACHE_MAX_BYTES, DEFAULT_RUNTIME_CACHE_KEEP_PREVIOUS, RUNTIME_NPM_INSTALL_FLAGS, RUNTIME_NPM_PACK_FLAGS, EMBEDDED_POSTGRES_PACKAGE_NAME, RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_RUNTIME_ARCHIVE_URL_ENV, RUDDER_POSTGRES_RUNTIME_DOWNLOAD_TIMEOUT_MS_ENV, RUNTIME_CACHE_PACKAGE_JSON, NPM_PLATFORM_REPAIR_ENV, RuntimeInstallError;
+var RUNTIME_NPM_PACKAGE_NAME, NPM_PUBLIC_REGISTRY_URL, RUNTIME_METADATA_FILE, RUNTIME_POSTGRES_PAYLOAD_DIR, DEFAULT_RUNTIME_CACHE_MAX_ENTRIES, DEFAULT_RUNTIME_CACHE_MAX_AGE_MS, DEFAULT_RUNTIME_CACHE_MAX_BYTES, DEFAULT_RUNTIME_CACHE_KEEP_PREVIOUS, RUNTIME_NPM_INSTALL_FLAGS, RUNTIME_NPM_PACK_FLAGS, EMBEDDED_POSTGRES_PACKAGE_NAME, RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_RUNTIME_ARCHIVE_URL_ENV, RUDDER_POSTGRES_RUNTIME_DOWNLOAD_TIMEOUT_MS_ENV, RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256_ENV, RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV, DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES, RUNTIME_CACHE_PACKAGE_JSON, NPM_PLATFORM_REPAIR_ENV, RuntimeInstallError;
 var init_install = __esm({
   "src/runtime/install.ts"() {
     "use strict";
@@ -6693,6 +6747,9 @@ var init_install = __esm({
     RUDDER_POSTGRES_BIN_DIR_ENV = "RUDDER_POSTGRES_BIN_DIR";
     RUDDER_POSTGRES_RUNTIME_ARCHIVE_URL_ENV = "RUDDER_POSTGRES_RUNTIME_ARCHIVE_URL";
     RUDDER_POSTGRES_RUNTIME_DOWNLOAD_TIMEOUT_MS_ENV = "RUDDER_POSTGRES_RUNTIME_DOWNLOAD_TIMEOUT_MS";
+    RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256_ENV = "RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256";
+    RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV = "RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES";
+    DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES = 1024 * 1024 * 1024;
     RUNTIME_CACHE_PACKAGE_JSON = {
       name: "rudder-runtime-cache",
       version: "0.0.0",
@@ -12384,41 +12441,41 @@ var RudderApiClient = class {
     this.signal = opts.signal;
     this.recoverAuth = opts.recoverAuth;
   }
-  get(path24, opts) {
-    return this.request(path24, { method: "GET" }, opts);
+  get(path25, opts) {
+    return this.request(path25, { method: "GET" }, opts);
   }
-  post(path24, body, opts) {
-    return this.request(path24, {
+  post(path25, body, opts) {
+    return this.request(path25, {
       method: "POST",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  postForm(path24, form, opts) {
-    return this.request(path24, {
+  postForm(path25, form, opts) {
+    return this.request(path25, {
       method: "POST",
       body: form
     }, opts);
   }
-  patch(path24, body, opts) {
-    return this.request(path24, {
+  patch(path25, body, opts) {
+    return this.request(path25, {
       method: "PATCH",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  put(path24, body, opts) {
-    return this.request(path24, {
+  put(path25, body, opts) {
+    return this.request(path25, {
       method: "PUT",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  delete(path24, opts) {
-    return this.request(path24, { method: "DELETE" }, opts);
+  delete(path25, opts) {
+    return this.request(path25, { method: "DELETE" }, opts);
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey?.trim() || void 0;
   }
-  async request(path24, init, opts, hasRetriedAuth = false) {
-    const url = buildUrl(this.apiBase, path24);
+  async request(path25, init, opts, hasRetriedAuth = false) {
+    const url = buildUrl(this.apiBase, path25);
     const headers = {
       accept: "application/json",
       ...toStringRecord(init.headers)
@@ -12449,13 +12506,13 @@ var RudderApiClient = class {
       const apiError = await toApiError(response);
       if (!hasRetriedAuth && this.recoverAuth) {
         const recoveredToken = await this.recoverAuth({
-          path: path24,
+          path: path25,
           method: String(init.method ?? "GET").toUpperCase(),
           error: apiError
         });
         if (recoveredToken) {
           this.setApiKey(recoveredToken);
-          return this.request(path24, init, opts, true);
+          return this.request(path25, init, opts, true);
         }
       }
       throw apiError;
@@ -12474,8 +12531,8 @@ function shouldAttachAgentContext(method) {
   const normalized = String(method ?? "GET").toUpperCase();
   return normalized !== "GET" && normalized !== "HEAD";
 }
-function buildUrl(apiBase, path24) {
-  const normalizedPath = path24.startsWith("/") ? path24 : `/${path24}`;
+function buildUrl(apiBase, path25) {
+  const normalizedPath = path25.startsWith("/") ? path25 : `/${path25}`;
   const [pathname, query] = normalizedPath.split("?");
   const url = new URL2(apiBase);
   url.pathname = `${url.pathname.replace(/\/+$/, "")}${pathname}`;
@@ -14934,8 +14991,8 @@ function registerActivityCommands(program) {
         if (opts.entityType) params.set("entityType", opts.entityType);
         if (opts.entityId) params.set("entityId", opts.entityId);
         const query = params.toString();
-        const path24 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
-        const rows = await ctx.api.get(path24) ?? [];
+        const path25 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
+        const rows = await ctx.api.get(path25) ?? [];
         if (ctx.json) {
           printOutput(rows, { json: true });
           return;
@@ -19868,8 +19925,8 @@ function registerUserCommands(program) {
         appendParam(params, "limit", opts.limit);
         appendParam(params, "cursor", opts.cursor);
         const query = params.toString();
-        const path24 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
-        const result = await ctx.api.get(path24);
+        const path25 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
+        const result = await ctx.api.get(path25);
         if (ctx.json) {
           printOutput(result, { json: true });
           return;
@@ -20681,22 +20738,48 @@ init_onboard();
 init_run();
 
 // src/commands/start.ts
-init_home();
-init_install2();
-init_install();
 import * as p15 from "@clack/prompts";
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash2, randomUUID } from "node:crypto";
-import { createWriteStream, constants as fsConstants, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { access, chmod, copyFile as copyFile2, cp as cp2, lstat, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm2, stat as stat5, utimes, writeFile as writeFile3 } from "node:fs/promises";
+import { createHash as createHash4, randomUUID } from "node:crypto";
+import { constants as fsConstants, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
+import { access, chmod, copyFile as copyFile2, cp as cp2, lstat, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm3, stat as stat5, utimes, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import path22 from "node:path";
-import { Readable, Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { clearTimeout as clearTimeout2, setTimeout as setTimeout2 } from "node:timers";
+import path23 from "node:path";
+import { clearTimeout as clearTimeout3, setTimeout as setTimeout3 } from "node:timers";
 import { setTimeout as delay2 } from "node:timers/promises";
 import pc14 from "picocolors";
 
+// src/checksum-manifest.ts
+function parseChecksumFile(contents) {
+  const checksums = /* @__PURE__ */ new Map();
+  for (const [index, line] of contents.split(/\r?\n/).entries()) {
+    if (!line.trim()) continue;
+    const match = line.match(/^([a-fA-F0-9]{64})[ \t]+\*?(\S+)[ \t]*$/);
+    if (!match) {
+      throw new Error(`Invalid SHA-256 checksum manifest line ${index + 1}.`);
+    }
+    const assetName = match[2];
+    if (checksums.has(assetName)) {
+      throw new Error(`Duplicate SHA-256 checksum manifest entry for ${assetName}.`);
+    }
+    checksums.set(assetName, match[1].toLowerCase());
+  }
+  if (checksums.size === 0) throw new Error("Desktop release checksum manifest is empty.");
+  return checksums;
+}
+
+// src/commands/start.ts
+init_home();
+
+// src/desktop-download.ts
+import { createHash as createHash3 } from "node:crypto";
+import { createWriteStream as createWriteStream2, mkdirSync } from "node:fs";
+import { rm as rm2 } from "node:fs/promises";
+import path22 from "node:path";
+import { Readable as Readable2, Transform as Transform2 } from "node:stream";
+import { pipeline as pipeline2 } from "node:stream/promises";
+import { clearTimeout as clearTimeout2, setTimeout as setTimeout2 } from "node:timers";
+
 // src/utils/progress.ts
 var BYTE_UNITS = ["B", "KB", "MB", "GB", "TB"];
 function formatBytes(bytes) {
@@ -20804,9 +20887,201 @@ function createByteProgress(label, options = {}) {
   };
 }
 
+// src/desktop-download.ts
+var DEFAULT_DESKTOP_RELEASE_REPO = "Undertone0809/rudder";
+var DEFAULT_DESKTOP_RELEASE_MIRROR_BASE_URL = "https://rudder-releases-cn-1302936001.cos.ap-shanghai.myqcloud.com";
+var GITHUB_ASSET_DOWNLOAD_ACCEPT = "application/octet-stream";
+var DESKTOP_DOWNLOAD_SOURCE_PROBE_TIMEOUT_MS = 3e3;
+var DESKTOP_ASSET_RESPONSE_TIMEOUT_MS = 3e4;
+var DESKTOP_ASSET_IDLE_TIMEOUT_MS = 3e4;
+function resolveDesktopDownloadSource(optionValue, env = process.env) {
+  const value = optionValue?.trim() || env.RUDDER_DOWNLOAD_SOURCE?.trim() || "auto";
+  if (value === "auto" || value === "cn" || value === "global") return value;
+  throw new Error(`Desktop download source must be auto, cn, or global. Received ${value}.`);
+}
+function normalizeReleaseMirrorBaseUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`Invalid Rudder release mirror base URL: ${value}`);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error(`Rudder release mirror base URL must use HTTP or HTTPS: ${value}`);
+  }
+  parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed.toString().replace(/\/$/, "");
+}
+function resolveDesktopReleaseMirrorBaseUrl(repo, env = process.env) {
+  const override = env.RUDDER_RELEASE_MIRROR_BASE_URL?.trim();
+  if (override) return normalizeReleaseMirrorBaseUrl(override);
+  return repo === DEFAULT_DESKTOP_RELEASE_REPO ? DEFAULT_DESKTOP_RELEASE_MIRROR_BASE_URL : null;
+}
+function encodeReleaseTagForDownloadUrl(tag) {
+  return tag.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+function buildReleaseMirrorAssetDownloadUrl(baseUrl, tag, assetName) {
+  const encodedTag = encodeReleaseTagForDownloadUrl(tag);
+  return `${normalizeReleaseMirrorBaseUrl(baseUrl)}/releases/${encodedTag}/${encodeURIComponent(assetName)}`;
+}
+function githubAssetDownloadUrls(asset) {
+  return [asset.browser_download_url, asset.url].filter((url) => Boolean(url));
+}
+function uniqueAssetDownloadUrls(asset) {
+  const urls = asset.download_urls ?? githubAssetDownloadUrls(asset);
+  return Array.from(new Set(urls));
+}
+function withDesktopDownloadOrigins(asset, origins, options) {
+  const githubUrls = githubAssetDownloadUrls(asset);
+  const urls = origins.flatMap((origin) => {
+    if (origin === "github") return githubUrls;
+    if (!options.mirrorBaseUrl) return [];
+    return [buildReleaseMirrorAssetDownloadUrl(options.mirrorBaseUrl, options.tag, asset.name)];
+  });
+  return { ...asset, download_urls: Array.from(new Set(urls)) };
+}
+function downloadHeadersForAssetUrl(asset, url) {
+  return {
+    Accept: url === asset.url ? GITHUB_ASSET_DOWNLOAD_ACCEPT : "*/*",
+    "User-Agent": "rudder-cli-installer"
+  };
+}
+function formatFetchError(error) {
+  if (!(error instanceof Error)) return String(error);
+  const cause = error.cause;
+  if (cause instanceof Error) {
+    const code = cause.code;
+    const suffix = typeof code === "string" ? ` [${code}]` : "";
+    return `${error.message}: ${cause.message}${suffix}`;
+  }
+  return error.message;
+}
+function contentLengthFromHeaders(headers) {
+  const raw = headers.get("content-length");
+  if (!raw) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? value : null;
+}
+async function fetchWithTimeout(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timeout = setTimeout2(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout2(timeout);
+  }
+}
+async function probeDesktopDownloadUrl(url, timeoutMs = DESKTOP_DOWNLOAD_SOURCE_PROBE_TIMEOUT_MS) {
+  const startedAt = Date.now();
+  try {
+    const response = await fetchWithTimeout(
+      url,
+      {
+        headers: {
+          Accept: "*/*",
+          Range: "bytes=0-0",
+          "User-Agent": "rudder-cli-installer"
+        }
+      },
+      timeoutMs
+    );
+    if (!response.ok) return null;
+    await response.body?.cancel();
+    return Date.now() - startedAt;
+  } catch {
+    return null;
+  }
+}
+async function resolveDesktopDownloadOrigins(options) {
+  if (!options.mirrorBaseUrl) return ["github"];
+  if (options.source === "cn") return ["mirror", "github"];
+  if (options.source === "global") return ["github", "mirror"];
+  const mirrorUrl = buildReleaseMirrorAssetDownloadUrl(
+    options.mirrorBaseUrl,
+    options.tag,
+    options.checksumAsset.name
+  );
+  const githubUrl = options.checksumAsset.browser_download_url;
+  const [mirrorElapsed, githubElapsed] = await Promise.all([
+    probeDesktopDownloadUrl(mirrorUrl, options.probeTimeoutMs),
+    probeDesktopDownloadUrl(githubUrl, options.probeTimeoutMs)
+  ]);
+  if (mirrorElapsed !== null && (githubElapsed === null || mirrorElapsed <= githubElapsed)) {
+    return ["mirror", "github"];
+  }
+  return mirrorElapsed === null ? ["github"] : ["github", "mirror"];
+}
+async function downloadAsset(asset, outputDir, progressFactory = createByteProgress, expectedChecksum, timeouts = {}) {
+  mkdirSync(outputDir, { recursive: true });
+  const outputPath = path22.join(outputDir, path22.basename(asset.name));
+  const idleTimeoutMs = timeouts.idleMs ?? DESKTOP_ASSET_IDLE_TIMEOUT_MS;
+  const responseTimeoutMs = timeouts.responseMs ?? DESKTOP_ASSET_RESPONSE_TIMEOUT_MS;
+  const failures = [];
+  for (const url of uniqueAssetDownloadUrls(asset)) {
+    let progress = null;
+    let idleTimeout = null;
+    try {
+      const response = await fetchWithTimeout(
+        url,
+        { headers: downloadHeadersForAssetUrl(asset, url) },
+        responseTimeoutMs
+      );
+      if (!response.ok || !response.body) {
+        failures.push(`Failed to download ${asset.name} from ${url} (${response.status}).`);
+        continue;
+      }
+      const totalBytes = contentLengthFromHeaders(response.headers);
+      progress = progressFactory(`Downloading ${asset.name}`);
+      let receivedBytes = 0;
+      const hash = createHash3("sha256");
+      let monitor;
+      const armIdleTimeout = () => {
+        if (idleTimeout) clearTimeout2(idleTimeout);
+        idleTimeout = setTimeout2(() => {
+          monitor.destroy(new Error(`Download from ${url} made no progress for ${idleTimeoutMs}ms.`));
+        }, idleTimeoutMs);
+      };
+      monitor = new Transform2({
+        transform(chunk, encoding, callback) {
+          const bytes = typeof chunk === "string" ? Buffer.from(chunk, encoding) : chunk;
+          receivedBytes += bytes.length;
+          hash.update(bytes);
+          progress?.update(receivedBytes, totalBytes);
+          armIdleTimeout();
+          callback(null, chunk);
+        }
+      });
+      progress.start(totalBytes);
+      armIdleTimeout();
+      await pipeline2(Readable2.fromWeb(response.body), monitor, createWriteStream2(outputPath));
+      if (idleTimeout) clearTimeout2(idleTimeout);
+      idleTimeout = null;
+      const actualChecksum = hash.digest("hex");
+      if (expectedChecksum && actualChecksum !== expectedChecksum.toLowerCase()) {
+        progress.fail();
+        progress = null;
+        await rm2(outputPath, { force: true });
+        failures.push(`Checksum mismatch for ${asset.name} from ${url}.`);
+        continue;
+      }
+      progress.finish(receivedBytes, totalBytes);
+      return outputPath;
+    } catch (error) {
+      if (idleTimeout) clearTimeout2(idleTimeout);
+      progress?.fail();
+      await rm2(outputPath, { force: true });
+      failures.push(`Failed to download ${asset.name} from ${url}: ${formatFetchError(error)}.`);
+    }
+  }
+  throw new Error(failures.join("\n"));
+}
+
 // src/commands/start.ts
+init_install2();
+init_install();
 init_version();
-var DEFAULT_DESKTOP_RELEASE_REPO = "Undertone0809/rudder";
 var DESKTOP_UPDATE_QUIT_ARG = "--rudder-update-quit";
 var DESKTOP_UPDATE_FORCE_ARG = "--rudder-update-force";
 var STABLE_SEMVER_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
@@ -20818,7 +21093,6 @@ var DESKTOP_APP_NAME = "Rudder";
 var DESKTOP_METADATA_FILE = ".rudder-desktop-install.json";
 var DESKTOP_CHECKSUM_ASSET_NAME = "SHASUMS256.txt";
 var DESKTOP_ASSET_CACHE_DIR = "desktop-assets";
-var GITHUB_ASSET_DOWNLOAD_ACCEPT = "application/octet-stream";
 var DEFAULT_DESKTOP_ASSET_CACHE_MAX_ENTRIES = 2;
 var DEFAULT_DESKTOP_ASSET_CACHE_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
 var DEFAULT_DESKTOP_ASSET_CACHE_MAX_BYTES = 768 * 1024 * 1024;
@@ -20961,10 +21235,10 @@ function createDesktopApplySignalController() {
           if (settled) return;
           settled = true;
           forceWaiters.delete(finish);
-          clearTimeout2(timer);
+          clearTimeout3(timer);
           resolve(force);
         };
-        const timer = setTimeout2(() => finish(false), timeoutMs);
+        const timer = setTimeout3(() => finish(false), timeoutMs);
         timer.unref?.();
         forceWaiters.add(finish);
       });
@@ -20995,7 +21269,7 @@ function compareStableSemver(a, b) {
 }
 async function fetchLatestCliVersion() {
   const controller = new AbortController();
-  const timeout = setTimeout2(() => controller.abort(), 2e3);
+  const timeout = setTimeout3(() => controller.abort(), 2e3);
   try {
     const response = await fetch(CLI_REGISTRY_LATEST_URL, {
       signal: controller.signal,
@@ -21007,7 +21281,7 @@ async function fetchLatestCliVersion() {
   } catch {
     return null;
   } finally {
-    clearTimeout2(timeout);
+    clearTimeout3(timeout);
   }
 }
 async function getCliUpdateNotice(currentVersion) {
@@ -21048,38 +21322,38 @@ function resolveDesktopAssetTarget(platform = process.platform, arch = process.a
   throw new Error(`Rudder Desktop does not publish portable assets for ${platform}.`);
 }
 function resolveDefaultDesktopInstallRoot(target, env = process.env, homeDir = homedir()) {
-  if (target.platform === "macos") return path22.join(homeDir, "Applications");
+  if (target.platform === "macos") return path23.join(homeDir, "Applications");
   if (target.platform === "windows") {
-    const localAppData = env.LOCALAPPDATA?.trim() || path22.join(homeDir, "AppData", "Local");
-    return path22.join(localAppData, "Programs", DESKTOP_APP_NAME);
+    const localAppData = env.LOCALAPPDATA?.trim() || path23.join(homeDir, "AppData", "Local");
+    return path23.join(localAppData, "Programs", DESKTOP_APP_NAME);
   }
-  return path22.join(homeDir, ".local", "share", "rudder");
+  return path23.join(homeDir, ".local", "share", "rudder");
 }
 function resolveDesktopInstallPaths(target, installRoot) {
-  const root = path22.resolve(installRoot);
+  const root = path23.resolve(installRoot);
   if (target.platform === "macos") {
-    const appPath2 = path22.join(root, `${DESKTOP_APP_NAME}.app`);
+    const appPath2 = path23.join(root, `${DESKTOP_APP_NAME}.app`);
     return {
       installRoot: root,
       appPath: appPath2,
-      executablePath: path22.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
-      metadataPath: path22.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path23.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
+      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
     };
   }
   if (target.platform === "windows") {
     return {
       installRoot: root,
       appPath: root,
-      executablePath: path22.join(root, `${DESKTOP_APP_NAME}.exe`),
-      metadataPath: path22.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path23.join(root, `${DESKTOP_APP_NAME}.exe`),
+      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
     };
   }
-  const appPath = path22.join(root, `${DESKTOP_APP_NAME}.AppImage`);
+  const appPath = path23.join(root, `${DESKTOP_APP_NAME}.AppImage`);
   return {
     installRoot: root,
     appPath,
     executablePath: appPath,
-    metadataPath: path22.join(root, DESKTOP_METADATA_FILE)
+    metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
   };
 }
 function normalizeAssetName(name) {
@@ -21169,13 +21443,13 @@ function selectChecksummedDesktopAssetCandidate(candidates, checksums) {
 function selectChecksumAsset(assets) {
   return assets.find((asset) => asset.name.toLowerCase() === DESKTOP_CHECKSUM_ASSET_NAME.toLowerCase()) ?? null;
 }
-async function fetchWithTimeout(url, init, timeoutMs) {
+async function fetchWithTimeout2(url, init, timeoutMs) {
   const controller = new AbortController();
-  const timeout = setTimeout2(() => controller.abort(), timeoutMs);
+  const timeout = setTimeout3(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, { ...init, signal: controller.signal });
   } finally {
-    clearTimeout2(timeout);
+    clearTimeout3(timeout);
   }
 }
 function githubApiHeaders() {
@@ -21187,7 +21461,7 @@ function githubApiHeaders() {
 var GITHUB_API_TIMEOUT_MS = 15e3;
 async function fetchGithubRelease(repo, tag) {
   const endpoint = tag === "latest" ? `https://api.github.com/repos/${repo}/releases/latest` : `https://api.github.com/repos/${repo}/releases/tags/${encodeURIComponent(tag)}`;
-  const response = await fetchWithTimeout(endpoint, { headers: githubApiHeaders() }, GITHUB_API_TIMEOUT_MS);
+  const response = await fetchWithTimeout2(endpoint, { headers: githubApiHeaders() }, GITHUB_API_TIMEOUT_MS);
   if (!response.ok) {
     throw new Error(`GitHub Release ${tag} was not found in ${repo} (${response.status}).`);
   }
@@ -21211,11 +21485,11 @@ function resolveDesktopShellAssetName(version, target) {
   if (target.platform === "windows") return `${DESKTOP_APP_NAME}-${version}-windows-x64-shell.zip`;
   return null;
 }
-function encodeReleaseTagForDownloadUrl(tag) {
+function encodeReleaseTagForDownloadUrl2(tag) {
   return tag.split("/").map((segment) => encodeURIComponent(segment)).join("/");
 }
 function buildGithubReleaseAssetDownloadUrl(repo, tag, assetName) {
-  const encodedTag = encodeReleaseTagForDownloadUrl(tag);
+  const encodedTag = encodeReleaseTagForDownloadUrl2(tag);
   return `https://github.com/${repo}/releases/download/${encodedTag}/${encodeURIComponent(assetName)}`;
 }
 function buildGithubReleaseAsset(repo, tag, assetName) {
@@ -21224,102 +21498,22 @@ function buildGithubReleaseAsset(repo, tag, assetName) {
     browser_download_url: buildGithubReleaseAssetDownloadUrl(repo, tag, assetName)
   };
 }
-function uniqueAssetDownloadUrls(asset) {
-  const urls = [asset.browser_download_url, asset.url].filter((url) => Boolean(url));
-  return Array.from(new Set(urls));
-}
-function downloadHeadersForAssetUrl(asset, url) {
-  return {
-    Accept: url === asset.url ? GITHUB_ASSET_DOWNLOAD_ACCEPT : "*/*",
-    "User-Agent": "rudder-cli-installer"
-  };
-}
-function formatFetchError(error) {
-  if (!(error instanceof Error)) return String(error);
-  const cause = error.cause;
-  if (cause instanceof Error) {
-    const code = cause.code;
-    const suffix = typeof code === "string" ? ` [${code}]` : "";
-    return `${error.message}: ${cause.message}${suffix}`;
-  }
-  return error.message;
-}
-function contentLengthFromHeaders(headers) {
-  const raw = headers.get("content-length");
-  if (!raw) return null;
-  const value = Number(raw);
-  return Number.isFinite(value) && value > 0 ? value : null;
-}
-async function downloadAsset(asset, outputDir, progressFactory = createByteProgress) {
-  mkdirSync(outputDir, { recursive: true });
-  const outputPath = path22.join(outputDir, path22.basename(asset.name));
-  const ASSET_DOWNLOAD_TIMEOUT_MS = 6e5;
-  let response = null;
-  const failures = [];
-  for (const url of uniqueAssetDownloadUrls(asset)) {
-    try {
-      const candidate = await fetchWithTimeout(
-        url,
-        { headers: downloadHeadersForAssetUrl(asset, url) },
-        ASSET_DOWNLOAD_TIMEOUT_MS
-      );
-      if (candidate.ok && candidate.body) {
-        response = candidate;
-        break;
-      }
-      failures.push(`Failed to download ${asset.name} from ${url} (${candidate.status}).`);
-    } catch (error) {
-      failures.push(`Failed to download ${asset.name} from ${url}: ${formatFetchError(error)}.`);
-    }
-  }
-  if (!response) {
-    throw new Error(failures.join("\n"));
-  }
-  const totalBytes = contentLengthFromHeaders(response.headers);
-  const progress = progressFactory(`Downloading ${asset.name}`);
-  let receivedBytes = 0;
-  const monitor = new Transform({
-    transform(chunk, _encoding, callback) {
-      receivedBytes += typeof chunk === "string" ? Buffer.byteLength(chunk) : chunk.length;
-      progress.update(receivedBytes, totalBytes);
-      callback(null, chunk);
-    }
-  });
-  progress.start(totalBytes);
-  try {
-    await pipeline(Readable.fromWeb(response.body), monitor, createWriteStream(outputPath));
-    progress.finish(receivedBytes, totalBytes);
-  } catch (error) {
-    progress.fail();
-    throw error;
-  }
-  return outputPath;
-}
 function checksumForFile(filePath) {
-  const hash = createHash2("sha256");
+  const hash = createHash4("sha256");
   hash.update(readFileSync2(filePath));
   return hash.digest("hex");
 }
-function parseChecksumFile(contents) {
-  const checksums = /* @__PURE__ */ new Map();
-  for (const line of contents.split(/\r?\n/)) {
-    const match = line.match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
-    if (!match) continue;
-    checksums.set(match[2].trim(), match[1].toLowerCase());
-  }
-  return checksums;
-}
 function resolveAssetChecksum(checksums, assetName) {
-  const expected = checksums.get(path22.basename(assetName));
+  const expected = checksums.get(path23.basename(assetName));
   if (!expected) {
-    throw new Error(`Desktop release checksums do not include ${path22.basename(assetName)}.`);
+    throw new Error(`Desktop release checksums do not include ${path23.basename(assetName)}.`);
   }
   return expected;
 }
 function assertChecksumMatch(filePath, expected) {
   const actual = checksumForFile(filePath);
   if (actual !== expected.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path22.basename(filePath)}.`);
+    throw new Error(`Checksum mismatch for ${path23.basename(filePath)}.`);
   }
   return actual;
 }
@@ -21338,10 +21532,10 @@ function normalizeDesktopAssetChecksum(checksum) {
   return normalized;
 }
 function resolveDesktopAssetCacheDir(assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path22.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
+  return path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
 }
 function resolveDesktopCachedAssetPath(assetName, assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path22.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path22.basename(assetName));
+  return path23.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path23.basename(assetName));
 }
 async function pruneDesktopAssetCache(options = {}) {
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
@@ -21362,7 +21556,7 @@ async function pruneDesktopAssetCache(options = {}) {
   const warnings = [];
   for (const entry of deletions) {
     try {
-      await rm2(entry.cacheDir, { recursive: true, force: true });
+      await rm3(entry.cacheDir, { recursive: true, force: true });
       deleted.push({
         cacheDir: entry.cacheDir,
         checksum: entry.checksum,
@@ -21387,7 +21581,7 @@ async function maybePruneDesktopAssetCache(options) {
   return result.deleted.length > 0 || result.warnings.length > 0 ? result : null;
 }
 async function scanDesktopAssetCacheEntries(homeDir) {
-  const cacheRoot = path22.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
+  const cacheRoot = path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
   const dirents = await readdir3(cacheRoot, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
@@ -21399,7 +21593,7 @@ async function scanDesktopAssetCacheEntries(homeDir) {
     } catch {
       continue;
     }
-    const cacheDir = path22.join(cacheRoot, dirent.name);
+    const cacheDir = path23.join(cacheRoot, dirent.name);
     const stats = await desktopCacheDirectoryStats(cacheDir);
     entries.push({
       cacheDir,
@@ -21423,7 +21617,7 @@ async function desktopCacheDirectoryStats(targetPath) {
   let lastUsedAtMs = Number(fallbackStat?.mtimeMs ?? 0);
   for (const dirent of dirents) {
     if (dirent.isSymbolicLink()) continue;
-    const entryPath = path22.join(targetPath, dirent.name);
+    const entryPath = path23.join(targetPath, dirent.name);
     const entryStat = await stat5(entryPath).catch(() => null);
     if (!entryStat) continue;
     lastUsedAtMs = Math.max(lastUsedAtMs, Number(entryStat.mtimeMs ?? 0));
@@ -21497,21 +21691,21 @@ async function downloadDesktopAssetWithCache(asset, expectedChecksum, options =
       await touchDesktopCachedAsset(cachePath);
       return { path: cachePath, checksum, cacheStatus: "hit" };
     } catch {
-      await rm2(cachePath, { force: true });
+      await rm3(cachePath, { force: true });
     }
   }
-  const outputDir = options.outputDir ?? await mkdtemp2(path22.join(tmpdir(), "rudder-desktop-installer."));
+  const outputDir = options.outputDir ?? await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
   const removeOutputDir = options.outputDir ? false : true;
   try {
-    const downloadedPath = await downloadAsset(asset, outputDir, options.progressFactory);
+    const downloadedPath = await downloadAsset(asset, outputDir, options.progressFactory, normalizedChecksum);
     const checksum = assertChecksumMatch(downloadedPath, normalizedChecksum);
-    await mkdir4(path22.dirname(cachePath), { recursive: true });
-    if (path22.resolve(downloadedPath) !== path22.resolve(cachePath)) {
+    await mkdir4(path23.dirname(cachePath), { recursive: true });
+    if (path23.resolve(downloadedPath) !== path23.resolve(cachePath)) {
       await copyFile2(downloadedPath, cachePath);
     }
     return { path: cachePath, checksum, cacheStatus: "miss" };
   } finally {
-    if (removeOutputDir) await rm2(outputDir, { recursive: true, force: true });
+    if (removeOutputDir) await rm3(outputDir, { recursive: true, force: true });
   }
 }
 async function pathExists2(targetPath) {
@@ -21523,8 +21717,8 @@ async function pathExists2(targetPath) {
   }
 }
 function resolveDesktopInstallLockPath(paths) {
-  const installRootHash = createHash2("sha256").update(path22.resolve(paths.installRoot)).digest("hex").slice(0, 16);
-  return path22.join(path22.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
+  const installRootHash = createHash4("sha256").update(path23.resolve(paths.installRoot)).digest("hex").slice(0, 16);
+  return path23.join(path23.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
 }
 async function readDesktopInstallLock(lockPath) {
   try {
@@ -21544,14 +21738,14 @@ async function readDesktopInstallLock(lockPath) {
 }
 async function withDesktopInstallLock(paths, fn, options = {}) {
   const lockPath = resolveDesktopInstallLockPath(paths);
-  const lockDir = path22.dirname(lockPath);
+  const lockDir = path23.dirname(lockPath);
   const timeoutMs = options.timeoutMs ?? DESKTOP_INSTALL_LOCK_TIMEOUT_MS;
   const pollMs = options.pollMs ?? DESKTOP_INSTALL_LOCK_POLL_MS;
   const startedAt = Date.now();
   const payload = {
     lockId: randomUUID(),
     pid: process.pid,
-    installRoot: path22.resolve(paths.installRoot),
+    installRoot: path23.resolve(paths.installRoot),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await mkdir4(lockDir, { recursive: true });
@@ -21566,7 +21760,7 @@ async function withDesktopInstallLock(paths, fn, options = {}) {
       const existing = await readDesktopInstallLock(lockPath);
       const stale = !existing || !processExists(existing.pid);
       if (stale) {
-        await rm2(lockPath, { force: true });
+        await rm3(lockPath, { force: true });
         continue;
       }
       if (Date.now() - startedAt >= timeoutMs) {
@@ -21582,7 +21776,7 @@ async function withDesktopInstallLock(paths, fn, options = {}) {
   } finally {
     const existing = await readDesktopInstallLock(lockPath);
     if (existing?.lockId === payload.lockId) {
-      await rm2(lockPath, { force: true });
+      await rm3(lockPath, { force: true });
     }
   }
 }
@@ -21604,7 +21798,7 @@ function powershellQuote(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
 function buildWindowsZipExtractCommand(zipPath, outputDir) {
-  return { command: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", `Expand-Archive -LiteralPath ${powershellQuote(zipPath)} -DestinationPath ${powershellQuote(outputDir)} -Force`] };
+  return { command: "tar.exe", args: ["-xf", zipPath, "-C", outputDir] };
 }
 function buildWindowsRobocopyMirrorCommand(sourcePath, destinationPath) {
   return {
@@ -21616,7 +21810,7 @@ function isSuccessfulRobocopyExitCode(status) {
   return typeof status === "number" && status >= 0 && status <= 7;
 }
 async function extractZip(zipPath, outputDir, target) {
-  await rm2(outputDir, { recursive: true, force: true });
+  await rm3(outputDir, { recursive: true, force: true });
   await mkdir4(outputDir, { recursive: true });
   if (target.platform === "macos") {
     runChecked("ditto", ["-x", "-k", zipPath, outputDir]);
@@ -21633,7 +21827,7 @@ async function findPath(root, predicate, maxDepth = 5) {
   async function visit(dir, depth) {
     const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path22.join(dir, entry.name);
+      const fullPath = path23.join(dir, entry.name);
       if (predicate(fullPath, entry.isDirectory())) return fullPath;
       if (entry.isDirectory() && depth < maxDepth) {
         const nested = await visit(fullPath, depth + 1);
@@ -21645,18 +21839,18 @@ async function findPath(root, predicate, maxDepth = 5) {
   return await visit(root, 0);
 }
 async function findMacApp(extractDir) {
-  const direct = path22.join(extractDir, `${DESKTOP_APP_NAME}.app`);
+  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.app`);
   if (await pathExists2(direct)) return direct;
-  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path22.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
+  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path23.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
   if (!found) throw new Error(`Portable macOS archive did not contain ${DESKTOP_APP_NAME}.app.`);
   return found;
 }
 async function findWindowsAppDir(extractDir) {
-  const direct = path22.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
+  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
   if (await pathExists2(direct)) return extractDir;
-  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path22.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
+  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path23.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
   if (!executable) throw new Error(`Portable Windows archive did not contain ${DESKTOP_APP_NAME}.exe.`);
-  return path22.dirname(executable);
+  return path23.dirname(executable);
 }
 async function readInstallMetadata(metadataPath) {
   try {
@@ -21724,7 +21918,7 @@ async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
 }
 async function requestDesktopQuit(executablePath, target, options = {}) {
   if (!await pathExists2(executablePath)) return { ok: true, status: "not_running" };
-  const responsePath = path22.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
+  const responsePath = path23.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
   const result = spawnSync4(executablePath, [
     `${DESKTOP_UPDATE_QUIT_ARG}=${responsePath}`,
     ...options.forceUpdate ? [DESKTOP_UPDATE_FORCE_ARG] : []
@@ -21738,7 +21932,7 @@ async function requestDesktopQuit(executablePath, target, options = {}) {
   try {
     return await waitForUpdateQuitResponse(responsePath, options.responseTimeoutMs);
   } finally {
-    await rm2(responsePath, { force: true });
+    await rm3(responsePath, { force: true });
   }
 }
 function processExists(pid) {
@@ -21774,7 +21968,7 @@ async function waitForProcessesExit(pids, waitForExit) {
 async function removePathWithRetry(targetPath, attempts = 5) {
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
-      await rm2(targetPath, { recursive: true, force: true });
+      await rm3(targetPath, { recursive: true, force: true });
       if (!await pathExists2(targetPath)) return true;
     } catch {
     }
@@ -21888,7 +22082,7 @@ async function installPortableDesktop(installerPath, paths, target) {
     await chmod(paths.appPath, 493);
     return;
   }
-  const extractDir = await mkdtemp2(path22.join(tmpdir(), "rudder-desktop-extract."));
+  const extractDir = await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-extract."));
   try {
     await extractZip(installerPath, extractDir, target);
     if (target.platform === "macos") {
@@ -21897,10 +22091,10 @@ async function installPortableDesktop(installerPath, paths, target) {
       return;
     }
     const appSource = await findWindowsAppDir(extractDir);
-    await mkdir4(path22.dirname(paths.installRoot), { recursive: true });
+    await mkdir4(path23.dirname(paths.installRoot), { recursive: true });
     await copyPortableAppBundle(appSource, paths.installRoot);
   } finally {
-    await rm2(extractDir, { recursive: true, force: true });
+    await rm3(extractDir, { recursive: true, force: true });
   }
 }
 async function copyPortableAppBundle(sourcePath, destinationPath) {
@@ -21938,12 +22132,12 @@ function buildLinuxDesktopEntry(executablePath) {
   ].join("\n");
 }
 async function writeLinuxLaunchers(paths) {
-  const desktopDir = path22.join(homedir(), ".local", "share", "applications");
+  const desktopDir = path23.join(homedir(), ".local", "share", "applications");
   await mkdir4(desktopDir, { recursive: true });
-  await writeFile3(path22.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
-  const binDir = path22.join(homedir(), ".local", "bin");
+  await writeFile3(path23.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
+  const binDir = path23.join(homedir(), ".local", "bin");
   await mkdir4(binDir, { recursive: true });
-  const wrapperPath = path22.join(binDir, "rudder-desktop");
+  const wrapperPath = path23.join(binDir, "rudder-desktop");
   const escaped = paths.executablePath.replaceAll("'", `'"'"'`);
   await writeFile3(wrapperPath, `#!/bin/sh
 exec '${escaped}' "$@"
@@ -21951,13 +22145,13 @@ exec '${escaped}' "$@"
   await chmod(wrapperPath, 493);
 }
 function buildWindowsShortcutScript(executablePath) {
-  const appData = process.env.APPDATA?.trim() || path22.join(homedir(), "AppData", "Roaming");
-  const shortcutPath = path22.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
+  const appData = process.env.APPDATA?.trim() || path23.join(homedir(), "AppData", "Roaming");
+  const shortcutPath = path23.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
   return [
     "$shell = New-Object -ComObject WScript.Shell",
     `$shortcut = $shell.CreateShortcut(${powershellQuote(shortcutPath)})`,
     `$shortcut.TargetPath = ${powershellQuote(executablePath)}`,
-    `$shortcut.WorkingDirectory = ${powershellQuote(path22.dirname(executablePath))}`,
+    `$shortcut.WorkingDirectory = ${powershellQuote(path23.dirname(executablePath))}`,
     "$shortcut.Save()"
   ].join("; ");
 }
@@ -21989,7 +22183,7 @@ function launchDesktop(paths, target) {
   spawn3(paths.executablePath, [], { detached: true, stdio: "ignore" }).unref();
 }
 async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum, assetKind = "full") {
-  mkdirSync(path22.dirname(paths.metadataPath), { recursive: true });
+  mkdirSync2(path23.dirname(paths.metadataPath), { recursive: true });
   const metadata = {
     version: 1,
     releaseTag,
@@ -21998,7 +22192,7 @@ async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum,
     assetKind,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  mkdirSync(paths.installRoot, { recursive: true });
+  mkdirSync2(paths.installRoot, { recursive: true });
   await writeFile3(paths.metadataPath, `${JSON.stringify(metadata, null, 2)}
 `, "utf8");
 }
@@ -22044,7 +22238,7 @@ async function startCommand(opts) {
     if (!exactDesktopAssetPath || !exactDesktopAssetChecksum || !exactDesktopAssetName || !exactDesktopReleaseDigest) {
       throw new Error("Exact Desktop asset mode requires path, checksum, asset name, and release digest.");
     }
-    if (!path22.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
+    if (!path23.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
       throw new Error("Exact Desktop asset mode received invalid candidate identity.");
     }
     if (opts.desktopAssetKind && opts.desktopAssetKind !== "full" && opts.desktopAssetKind !== "shell") {
@@ -22122,15 +22316,18 @@ async function startCommand(opts) {
     }
   }
   if (installDesktop) {
+    const downloadSource = resolveDesktopDownloadSource(opts.downloadSource);
+    const mirrorBaseUrl = resolveDesktopReleaseMirrorBaseUrl(repo);
     const target = resolveDesktopAssetTarget();
     const tag = resolveDesktopReleaseTag(version);
-    const installRoot = opts.desktopInstallDir ? path22.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
+    const installRoot = opts.desktopInstallDir ? path23.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
     const installPaths = resolveDesktopInstallPaths(target, installRoot);
-    const outputDir = opts.outputDir ? path22.resolve(opts.outputDir) : await mkdtemp2(path22.join(tmpdir(), "rudder-desktop-installer."));
+    const outputDir = opts.outputDir ? path23.resolve(opts.outputDir) : await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
     p15.log.step("Installing desktop app");
     p15.log.message(`Release: ${pc14.cyan(`${repo}@${tag}`)}`);
     p15.log.message(`Target: ${pc14.cyan(`${target.platform}/${target.arch}`)}`);
     p15.log.message(`Install: ${pc14.cyan(installPaths.appPath)}`);
+    p15.log.message(`Download source: ${pc14.cyan(downloadSource)}`);
     if (dryRun) {
       p15.log.message(`[dry-run] Would resolve, download, verify, install, and ${opts.open === false ? "not launch" : "launch"} Rudder Desktop.`);
       p15.outro(pc14.green("Dry run complete."));
@@ -22145,6 +22342,7 @@ async function startCommand(opts) {
       let cachedAsset = null;
       let assetCandidates = [];
       let checksums = /* @__PURE__ */ new Map();
+      let downloadOrigins = ["github"];
       if (exactDesktopAssetPath) {
         releaseTag = tag;
         selectedAsset = {
@@ -22153,7 +22351,7 @@ async function startCommand(opts) {
         };
         selectedAssetKind = opts.desktopAssetKind ?? "full";
         expectedChecksum = normalizeDesktopAssetChecksum(exactDesktopAssetChecksum);
-        const computedReleaseDigest = createHash2("sha256").update(JSON.stringify({
+        const computedReleaseDigest = createHash4("sha256").update(JSON.stringify({
           releaseTag,
           assetName: selectedAsset.name,
           assetChecksum: expectedChecksum,
@@ -22170,7 +22368,7 @@ async function startCommand(opts) {
         if (linkDescriptor.isSymbolicLink()) throw new Error("Exact Desktop asset must not be a symbolic link.");
         const checksum = await runStartPhase(
           "Verifying staged Desktop checksum...",
-          `Verified ${pc14.cyan(path22.basename(exactDesktopAssetPath))}.`,
+          `Verified ${pc14.cyan(path23.basename(exactDesktopAssetPath))}.`,
           () => assertChecksumMatch(exactDesktopAssetPath, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -22205,6 +22403,20 @@ async function startCommand(opts) {
           throw new Error(`No Rudder Desktop portable asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
         }
         const checksumAsset = selectChecksumAsset(release?.assets ?? []) ?? (directReleaseVersion ? buildGithubReleaseAsset(repo, tag, DESKTOP_CHECKSUM_ASSET_NAME) : null);
+        if (!checksumAsset) {
+          throw new Error("Desktop release is missing SHASUMS256.txt.");
+        }
+        downloadOrigins = await resolveDesktopDownloadOrigins({
+          source: downloadSource,
+          checksumAsset,
+          tag: releaseTag,
+          mirrorBaseUrl
+        });
+        if (downloadOrigins[0] === "mirror") {
+          p15.log.message("Using the China release mirror with GitHub fallback.");
+        } else if (downloadSource !== "global" && mirrorBaseUrl) {
+          p15.log.message("Using GitHub for this network path.");
+        }
         checksums = await downloadChecksums(checksumAsset, outputDir, progressFactory);
         let selectedCandidate;
         try {
@@ -22213,7 +22425,10 @@ async function startCommand(opts) {
           throw new Error(`No checksummed Rudder Desktop asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
         }
         for (const warning of selectedCandidate.warnings) p15.log.warn(warning);
-        selectedAsset = selectedCandidate.asset;
+        selectedAsset = withDesktopDownloadOrigins(selectedCandidate.asset, downloadOrigins, {
+          mirrorBaseUrl,
+          tag: releaseTag
+        });
         selectedAssetKind = selectedCandidate.kind;
         expectedChecksum = selectedCandidate.expectedChecksum;
       }
@@ -22241,7 +22456,10 @@ async function startCommand(opts) {
           p15.log.warn(
             `Layered Desktop shell asset download failed; falling back to the full portable asset. ${formatFetchError(error)}`
           );
-          selectedAsset = fullCandidate.asset;
+          selectedAsset = withDesktopDownloadOrigins(fullCandidate.asset, downloadOrigins, {
+            mirrorBaseUrl,
+            tag: releaseTag
+          });
           selectedAssetKind = fullCandidate.kind;
           expectedChecksum = resolveAssetChecksum(checksums, selectedAsset.name);
           cachedAsset = await downloadDesktopAssetWithCache(selectedAsset, expectedChecksum, {
@@ -22263,7 +22481,7 @@ async function startCommand(opts) {
         }
         const checksum = await runStartPhase(
           "Verifying Desktop checksum...",
-          `Verified ${pc14.cyan(path22.basename(verifiedAsset.path))}.`,
+          `Verified ${pc14.cyan(path23.basename(verifiedAsset.path))}.`,
           () => assertChecksumMatch(verifiedAsset.path, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -22274,9 +22492,9 @@ async function startCommand(opts) {
             percent: 100,
             assetName: selectedAsset.name,
             assetChecksum: checksum,
-            stagedArtifactPath: path22.resolve(verifiedAsset.path),
+            stagedArtifactPath: path23.resolve(verifiedAsset.path),
             stagedArtifactDigest: checksum,
-            releaseDigest: createHash2("sha256").update(JSON.stringify({
+            releaseDigest: createHash4("sha256").update(JSON.stringify({
               releaseTag,
               assetName: selectedAsset.name,
               assetChecksum: checksum,
@@ -22367,11 +22585,11 @@ async function startCommand(opts) {
 
 // src/config/data-dir.ts
 init_home();
-import path23 from "node:path";
+import path24 from "node:path";
 function applyDataDirOverride(options, support = {}) {
   const rawDataDir = options.dataDir?.trim();
   if (!rawDataDir) return null;
-  const resolvedDataDir = path23.resolve(expandHomePrefix(rawDataDir));
+  const resolvedDataDir = path24.resolve(expandHomePrefix(rawDataDir));
   process.env.RUDDER_HOME = resolvedDataDir;
   if (support.hasConfigOption) {
     const hasConfigOverride = Boolean(options.config?.trim()) || Boolean(process.env.RUDDER_CONFIG?.trim());
@@ -22431,7 +22649,7 @@ function createProgram() {
     });
     loadRudderEnvFile(options.config);
   });
-  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
+  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--download-source <source>", "Desktop download source: auto, cn, or global").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
   program.command("onboard").description("Interactive first-run setup wizard").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("-y, --yes", "Accept defaults (quickstart + start immediately)", false).option("--run", "Start Rudder immediately after saving config", false).action(onboard);
   program.command("doctor").description("Run diagnostic checks on your Rudder setup").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--repair", "Attempt to repair issues automatically").alias("--fix").option("-y, --yes", "Skip repair confirmation prompts").action(async (opts) => {
     await doctor(opts);